GAO-19-479, 2017 Disaster Relief Oversight: …June 2019 2017 DISASTER RELIEF OVERSIGHT Strategy...

United States Government Accountability Office

Report to Congressional Requesters

June 2019

2017 DISASTERRELIEF OVERSIGHTStrategy Needed to EnsureAgencies’ Internal Control PlansProvide Sucient Information

GAO-19-479 www.gao.gov

HighlightsHighlights of GAO-19-479, a report toCongressional Requesters

June 2019

2017 DISASTER RELIEF OVERSIGHTStrategy Needed to Ensure Agencies’ Internal ControlPlans Provide Sucient Information

Why GAO Did This StudyAgencies must deliver disaster relieffunding expeditiously. However, therisk of improper payments increaseswhen agencies spend billions of dollarsquickly. In 2017, Hurricanes Harvey, Irma,and Maria and the California wildfirescreated an unprecedented demand forfederal disaster response and recoveryresources. Congress passed threesupplemental appropriations totalingover $120 billion in additional funding inresponse to these disasters. As part ofthe appropriations, Congress included anoversight framework that required federalagencies to submit internal control plansfor spending these funds by March 31,2018, in accordance with criteria to beestablished by OMB.

This report addresses the extent to whichselected federal agencies’ internal controlplans provided sufficient and timelyexternal communication to Congressand others. To address this objective,GAO selected for review six agenciesthat together received $115 billionof the approximately $120 billion insupplemental appropriations for activitiesin response to the 2017 disasters. GAOreviewed these agencies’ internal controlplans and M-18-14, evaluated the internalcontrol plans against M-18-14 and internalcontrol standards, and interviewed agencyofficials and OMB staff.

What GAO RecommendsGAO recommends that OMB developa strategy for ensuring that agenciescommunicate timely and sufficientinternal control plans for disasterrelief funds. OMB did not agree thatthis recommendation is needed. GAOcontinues to believe the recommendationis appropriate and needed, as discussedin the report.

View GAO-19-479. For more information,contact Beryl H. Davis at (202) 512-2623 [email protected]

What GAO FoundOf the six agencies GAO selected for review, only the Department of Educationsubmitted its internal control plan for disaster relief funds by the statutorydeadline. The Department of Defense did not submit an internal control plan.The Departments of Agriculture, Homeland Security, and Housing and UrbanDevelopment and the Small Business Administration submitted the requiredinternal control plans ranging from about 2 months to more than 7 monthsfollowing the March 31, 2018, statutory deadline.

The Office of Management and Budget (OMB) did not have an effective strategyto ensure that agencies timely submitted internal control plans. OMB issuedOMB Memorandum M-18-14 (M-18-14), Implementation of Internal Controlsand Grant Expenditures for the Disaster-Related Appropriations, which containedguidance for agencies to use in developing their plans, on March 30, 2018, or1 day before the statutory deadline for agencies to submit plans. Congressrequired OMB to issue standard guidance for agencies to use in designinginternal control plans. The guidance was to include robust criteria for identifyingand documenting incremental risks and mitigating controls related to disasterrelief funding, and guidance for documenting the linkage between incrementalrisks related to disaster relief funding and efforts to address known internalcontrol risks.

Selected agencies' plans did not include sufficient information for GAO todetermine if the agencies met OMB directives in M-18-14 and federal internalcontrol standards' documentation requirements. For example, two of the fiveplans GAO reviewed included information that demonstrated that the planscomplemented the agencies’ existing risk management practices, while threeplans lacked sufficient information to make such a determination. Further,M-18-14 lacked specific instructions to agencies on what to include in theirinternal control plans.

OMB did not have an effective outreach strategy to help ensure that agencieshad proper guidance in developing and reporting their plans. OMB did notestablish an external communication mechanism to ensure that internalcontrol plans addressed key payment-integrity risks for disaster relief funds.OMB staff stated that OMB Circular No. A-123's enterprise risk management(ERM) requirements were sufficient for agencies to produce effective internalcontrol plans, because agencies should consider disaster situations as part oftheir overall consideration of risk. However, while it is important that agenciesdevelop an effective ERM process, Congress required agencies to communicateinternal control plans associated with the supplemental funding provided.Federal internal control standards state that management should externallycommunicate necessary quality information to achieve the entity’s objectives.Without a clear OMB strategy for preparing for oversight of future disaster relieffunding, there is an increased risk that agencies will not appropriately assessrisks associated with disaster relief funding. As a result, Congress and othersmay not receive the necessary information about internal controls, which willaffect Congress’s and others’ ability to provide effective oversight.

United States Government Accountability Office

https://www.gao.gov/products/GAO-19-479

https://www.gao.gov/products/GAO-19-479

mailto:[email protected]

Recommendations Introduction Background MajorFinding Conclusions

AgencyComments andOur Evaluation

CongressionalAddressees Appendixes Contacts

Contents

Recommendations for Executive Action........................................................................................... 1

Introduction.............................................................................................................................................. 2

Background............................................................................................................................................... 5

Major Finding........................................................................................................................................... 9Selected Agencies’ Internal Control Plans Did Not CommunicateTimely and Sufficient Information Because OMB Did Not Employ anEffective Strategy 9

Conclusions............................................................................................................................................. 18

Agency Comments and Our Evaluation.......................................................................................... 19

Congressional Addressees................................................................................................................... 24

Appendixes.............................................................................................................................................. 26Appendix I: Comments from the Department of Education 26Appendix II: GAO Contact and Staff Acknowledgments 28

Contacts................................................................................................................................................... 29

FiguresFigure 1: Distribution of Funding Provided by the SupplementalAppropriations for the 2017 Disasters................................................... 5

Page i GAO-19-479




Abbreviations

DHS Department of Homeland Security

DOD Department of Defense

Education Department of Education

ERM enterprise risk management

HUD Department of Housing and UrbanDevelopment

IG inspector general

OMB Office of Management and Budget

SBA Small Business Administration

USACE U.S. Army Corps of Engineers

USDA Department of Agriculture

GAO’s Mission

The Government Accountability Office, the audit, evaluation, andinvestigative arm of Congress, exists to support Congress in meetingits constitutional responsibilities and to help improve the performanceand accountability of the federal government for the American people.GAO examines the use of public funds; evaluates federal programs andpolicies; and provides analyses, recommendations, and other assistanceto help Congress make informed oversight, policy, and funding decisions.GAO’s commitment to good government is reflected in its core values ofaccountability, integrity, and reliability.

Copyright

This is a work of the U.S. government and is not subject to copyrightprotection in the United States. The published product may bereproduced and distributed in its entirety without further permissionfrom GAO. However, because this work may contain copyrighted imagesor other material, permission from the copyright holder may be necessaryif you wish to reproduce this material separately.

Page ii GAO-19-479




Recommendations for Executive Action

• The Director of OMB, after consulting with key stakeholders(e.g., the Chief Financial Officers Council), should develop astrategy for ensuring that agencies communicate sufficientand timely internal control plans for effective oversight ofdisaster relief funds. (Recommendation 1)

Page 1 GAO-19-479




Introduction

June 28, 2019

Congressional Requesters

The destruction that disasters cause must be addressed immediately,and agencies must deliver disaster relief funding expeditiously.However, the risk of improper payments increases when agenciesspend billions of dollars quickly. In 2017, four sequential disasters—Hurricanes Harvey, Irma, and Maria and the California wildfires—created an unprecedented demand for federal disaster responseand recovery resources. Congress passed, and the President signed,three supplemental appropriations acts providing for over $120 billionin additional funding for response and recovery activities related tothese disasters. 1

In these supplemental appropriations acts, Congress also providedan oversight framework related to internal control to limit improperpayments of these funds. Congress included the following keypayment-integrity provisions to help ensure that agencies spenddisaster relief funding as efficiently and effectively as possible:

• The Office of Management and Budget (OMB) is required to issuecriteria for federal agencies to use in designing internal controlplans for spending disaster relief funding.

• Federal agencies are required to submit their plans for ensuringinternal control over spending disaster relief funding to GAO, theirrespective inspectors general (IG), OMB, and Congress.

We have previously reported deficiencies related to OMB’s guidancefor federal agencies to develop required internal control plans forfunds received under the Disaster Relief Appropriations Act of 2013

1This amount does not include transfers of unobligated balances from prior fiscalyears or indefinite appropriations authorized to forgive any outstanding balanceowed to the Department of Education under the Historically Black College andUniversity Hurricane Supplemental Loan Program. See Additional SupplementalAppropriations for Disaster Relief Requirements Act, 2017, Pub. L. No. 115-56, div.B, 131 Stat. 1129, 1136 (2017); Additional Supplemental Appropriations for DisasterRelief Requirements Act, 2017 Pub. L. No. 115-72, div. A, 131 Stat. 1224 (2017); andFurther Additional Supplemental Appropriations for Disaster Relief Requirements Act,2018, Pub. L. No. 115-123, div. B, subdiv. 1, 132 Stat. 64, 65 (2018).

Page 2 GAO-19-479




and federal agencies’ creation of those plans in response to HurricaneSandy. 2

You requested that we evaluate the federal government’spreparedness, response, and recovery efforts related to the threehurricanes and California wildfires in 2017. As part of that effort ,this report examines the extent to which selected federal agencies’internal control plans for spending disaster relief funds providedtimely and sufficient external communication to Congress and othersand OMB's strategy for implementing statutory requirements fordisaster relief internal control plans. In addition, we are conductinga broader body of work covering various disaster response andrecovery issues.

To address our objective, we selected for review six of the 19 agenciesthat received supplemental appropriations for activities in responseto the 2017 hurricanes and wildfires. We selected the six agenciesthat received the highest amounts of combined supplementalappropriations. Each of the six received in excess of $2 billion insupplemental disaster funding: together they received $115 billionof the approximately $120 billion in supplemental appropriations foractivities in response to the 2017 disasters. The six agencies werethe Departments of Agriculture (USDA), Defense (DOD), Education(Education), Homeland Security (DHS), and Housing and UrbanDevelopment (HUD) and the Small Business Administration (SBA).Because this was a nonprobability sample, our findings cannot begeneralized to agencies we did not select.

We identified and reviewed relevant agency criteria included in OMBMemorandum M-18-14 (M-18-14), Implementation of Internal Controlsand Grant Expenditures for the Disaster-Related Appropriations, andthen evaluated whether the internal control plans submitted bythe six agencies we selected included information to demonstratethat those agencies satisfied the OMB criteria. 3 We also evaluatedwhether the internal control plans satisfied minimum documentation

2GAO, Hurricane Sandy Relief: Improved Guidance on Designing Internal Control PlansCould Enhance Oversight of Disaster Funding, GAO-14-58 (Washington, D.C.: Nov. 26,2013).3Office of Management and Budget, Implementation of Internal Controls and GrantExpenditures for the Disaster-Related Appropriations, OMB Memorandum M-18-14(Washington, D.C.: Mar. 30, 2018).

Page 3 GAO-19-479




requirements included in Standards for Internal Control in the FederalGovernment. 4

We also reviewed whether agencies submitted the internal controlplans on or before the statutory deadline of March 31, 2018, andwhether agencies submitted the plans as required to OMB, GAO,their respective IGs, and the Committees on Appropriations forthe U.S. Senate and House of Representatives. We interviewedOMB staff to understand their strategy for implementing statutoryrequirements for disaster relief internal control plans and theirrationale behind guidance in M-18-14. We also interviewed agencyofficials to understand their processes for developing the internalcontrol plans, including how they interpreted OMB guidance inM-18-14 and its effect, if any, on helping agencies to meet thestatutory requirements.

We conducted this performance audit from April 2018 to June 2019 inaccordance with generally accepted government auditing standards.Those standards require that we plan and perform the audit to obtainsufficient, appropriate evidence to provide a reasonable basis for ourfindings and conclusions based on our audit objective. We believe thatthe evidence obtained provides a reasonable basis for our findingsand conclusions based on our audit objective.

4GAO, Standards for Internal Control in the Federal Government, GAO-14-704G(Washington, D.C.: September 2014).

Page 4 GAO-19-479




Background

SupplementalAppropriations for2017 Disaster Relief

Congress enacted three supplemental appropriations providing over$120 billion in funding for activities related to the 2017 disasters—Hurricanes Harvey, Irma, and Maria and the California wildfires. Figure1 shows the distribution of 2017 disaster relief funding by agency.

Figure 1: Distribution of Funding Provided by the Supplemental Appropriationsfor the 2017 Disasters

The Additional Supplemental Appropriations for Disaster ReliefRequirements Act, 2017, as amended by the Further AdditionalSupplemental Appropriations for Disaster Relief Requirements Act,2018, required that each federal agency prepare an internal controlplan, in accordance with OMB criteria, for funds provided by specifiedportions of these laws, and submit the plan to GAO, the agency’s IG,and the Committees on Appropriations of the U.S. Senate and Houseof Representatives by March 31, 2018. Congress also required OMBto issue standard guidance for agencies to use in designing internalcontrol plans, leveraging existing internal control review processes, fordisaster relief funding. The guidance was to include, at a minimum

• robust criteria for identifying and documenting incremental risksand mitigating controls related to disaster relief funding and

Page 5 GAO-19-479




• guidance for documenting the linkage between the incrementalrisks related to disaster funding and efforts to address knowninternal control risks.

OMB Guidance As noted above, the supplemental appropriations acts for 2017disasters required OMB to establish criteria for agencies to use indeveloping their 2017 disaster relief internal control plans due March31, 2018. OMB established the criteria in M-18-14, issued March30, 2018. This OMB memorandum provides guidance to agenciesto implement the internal control provisions of the 2017 disasterrelief supplemental appropriations, and in particular, it explainsagency responsibilities for managing disaster relief funds. M-18-14notes that as required by OMB Circular No. A-123, Management’sResponsibility for Enterprise Risk Management and Internal Control(Circular A-123), each agency has overall responsibility for establishinginternal controls to manage the risk of fraud—one source of improperpayments. 5 Additionally, OMB stated that agencies must use a risk-based approach to design and implement financial and administrativecontrols to identify and mitigate fraud risks.

Standards forInternal Controlin the FederalGovernment

Federal internal control standards provide the overall frameworkfor establishing and maintaining internal control in the federalgovernment. 6 Internal control should be designed, implemented,and operating effectively to provide reasonable assurance that theoperations, reporting, and compliance objectives of an entity will beachieved. The five components of internal control are as follows:

• Control environment: The foundation for an internal controlsystem. It provides the discipline and structure to help an entityachieve its objectives.

5Office of Management and Budget, Management’s Responsibility for EnterpriseRisk Management and Internal Control, Circular No. A-123 (Washington, D.C.: July 15,2016).6 GAO-14-704G.

Page 6 GAO-19-479




• Risk assessment: Assesses the risks facing the entity as it seeksto achieve its objectives. This assessment provides the basis fordeveloping appropriate risk responses.

• Control activities: The actions management establishes throughpolicies and procedures to achieve objectives and respond torisks in the internal control system, which includes the entity’sinformation system.

• Information and communication: The quality informationmanagement and personnel communicate and use to support theinternal control system.

• Monitoring: Activities management establishes and operates toassess the quality of performance over time and promptly resolvethe findings of audits and other reviews.

Documentation is a necessary part of an effective internal controlsystem. The level and nature of documentation vary based on thesize of the entity and the complexity of the operational processesthe entity performs. Documentation is required to demonstrate thedesign, implementation, and operating effectiveness of an entity’sinternal control system. Federal internal control standards' minimumdocumentation requirements are as follows:

• If management determines that a principle is not relevant,management supports that determination with documentationthat includes the rationale of how, in the absence of that principle,the associated component could be designed, implemented, andoperated effectively.

• Management develops and maintains documentation of itsinternal control system.

• Management documents in policies the internal controlresponsibilities of the organization.

• Management evaluates and documents the results of ongoingmonitoring and separate evaluations to identify internal controlissues.

• Management evaluates and documents internal control issuesand determines appropriate corrective actions for internal controldeficiencies on a timely basis.

Page 7 GAO-19-479




• Management completes and documents corrective actions toremediate internal control deficiencies on a timely basis.

Page 8 GAO-19-479




Major Finding

Selected Agencies’ Internal Control Plans Did Not CommunicateTimely and Sucient Information Because OMB Did Not Employan Eective Strategy

Selected agencies did not submit their internal control plans timelyand the plans lacked necessary information because OMB did notemploy an effective strategy for timely submission and sufficientcontent. OMB issued guidance for agencies to use in designinginternal control plans for disaster relief funding on March 30, 2018.This gave agencies 1 day to consult the guidance before their internalcontrol plans were due on March 31, 2018. Only one of the sixagencies we reviewed, Education, submitted its internal control planby the statutory deadline. In addition, OMB did not have an effectivestrategy to communicate to agencies the information that they had toinclude in their internal control plans. For the six selected agencies,one had not submitted an internal control plan as of April 2019. Forthe five that submitted internal control plans, their plans did notinclude sufficient information for us to determine whether they wereconsistent with OMB guidance and federal internal control standards'minimum documentation requirements.

Five of Six SelectedAgencies Did NotTimely SubmitInternal ControlPlans

The Additional Supplemental Appropriations for Disaster ReliefRequirements Act, 2017, as amended, required that each federalagency receiving funds submit, no later than March 31, 2018, and inaccordance with criteria to be established by OMB, an internal controlplan for spending funds on activities related to the 2017 disasters.Our review of six selected agencies found that most did not meet thisdeadline. Specifically, we found the following:

• Education was the only selected agency that submitted its internalcontrol plan by the statutory deadline.

• DOD had not submitted the required internal control planrelated to 2017 disaster funding as of April 2019. We inquiredwith officials at the U.S. Army Corps of Engineers (USACE), acomponent of DOD that received most of DOD’s supplementalappropriations for 2017 disaster response, to determine thestatus of its internal control plan. USACE officials stated thata review of internal controls for funds received through 2017

Page 9 GAO-19-479




disaster supplemental appropriations was incorporated in thefinancial statement audit that its independent public accountantconducted. However, we do not consider the financial statementaudit to constitute an internal control plan for 2017 disasterrelief funding because it does not describe the agency’s internalcontrols specific to that funding. Further, USACE officials providedus with a document labeled as an internal control plan forHurricanes Harvey, Irma, and Maria disaster relief dated March13, 2019. However, the officials stated that this was an internaldocument that had not been submitted to OMB or Congress, andthat DOD had not requested an internal control plan from USACEfor inclusion in a department-level internal control plan for 2017disaster relief funds.

• The other four selected agencies submitted the required internalcontrol plans after the March 31, 2018, statutory deadline.Specifically, SBA, USDA, DHS, and HUD submitted their plansin May 2018, August 2018, October 2018, and November 2018,respectively.

OMB did not have an effective strategy to ensure that agenciessubmitted their internal control plans by the statutory deadline.Specifically, OMB issued M-18-14, which contains guidance foragencies to use in developing their internal control plans, on March30, 2018, or 1 day before the agencies’ submission deadline. Officialsat Education, which submitted its plan on time, stated that they reliedon OMB’s Hurricane Sandy-related guidance in OMB MemorandumM-13-07 (M-13-07), Accountability for Funds Provided by the DisasterRelief Appropriations Act, to help develop their internal control plan inthe absence of more timely guidance from OMB. 7

Federal internal control standards state that management shouldexternally communicate the necessary quality information to achievethe entity’s objectives. 8 As part of this process , management selectsthe appropriate methods of communication, such as a writtendocument or meetings, to communicate quality information, suchas criteria for internal control plans, on a timely basis. Because OMBdid not establish an effective strategy for timely communicatingrequirements for agency reporting in internal control plans, federal

7Office of Management and Budget, Accountability for Funds Provided by the DisasterRelief Appropriations Act, Memorandum M-13-07 (Mar. 12, 2013).8 GAO-14-704G.

Page 10 GAO-19-479




agencies lacked the information needed to meet the statutorydeadline. As a result, Congress and others did not timely receiveagency internal control plans.

Selected Agencies'Internal ControlPlans Did NotInclude SucientInformation

As stated previously, five of the six selected agencies submitted therequired internal control plans to Congress and others, but theseplans did not include sufficient information that would allow us todetermine if the agencies met OMB directives and federal internalcontrol standards' minimum documentation requirements. Theinternal control plans we reviewed varied in completeness anddetail. For example, one agency's internal control plan was over 30pages in length, and it included not just descriptions of risks andmitigation strategies for funded activities but also descriptions ofthe components of internal control and the agency's strategy foraddressing them. Conversely, another agency's internal control planwas just over two pages in length. For its program receiving thelargest amount of disaster funding, this agency's description of itsinternal control plan consisted of one paragraph that identified oneincremental risk and mitigation strategy for that program. The agencydid not describe other controls it used to ensure the integrity for thepayment of funds in this program.

OMB did not provide specific instructions to agencies on whatto include in their internal control plans. We reviewed selectedagencies' internal control plans to determine whether they containedsufficient information to address the following directives in M-18-14 :(1) use a risk-based approach to design and implement financialand administrative controls to identify and mitigate fraud risks, (2)leverage existing enterprise risk management (ERM) processes inassessing risk in disaster situations, (3) weigh operational objectivesagainst the objective of lowering the likelihood of fraud whendetermining risk tolerances in disaster situations, (4) providereasonable assurance that the internal control plan specificallyaddresses disaster relief, and (5) describe how the plan complementsexisting risk management practices as directed in OMB Circular A-123.

Our review of the internal control plans found that agencies varied inthe extent to which their plans communicated how they addressedthe directives identified in M-18-14 and federal internal controlstandards. Specifically, our analysis of internal control plans found thefollowing:

Page 11 GAO-19-479




Use of a risk-based approach. M-18-14 states that in disastersituations, fraud risks are higher than under normal circumstancesbecause the need to provide services quickly can hinder theeffectiveness of existing controls and create additional opportunitiesfor individuals to engage in fraud. Thus, agencies must use a risk-based approach to design and implement financial and administrativecontrols to identify and mitigate fraud risks. In four of the five planswe reviewed, agencies addressed elements of using a risk-basedapproach. Examples of risks the agencies identified included fraudinvolving construction and related-party transactions, inaccurategrantee data submissions, and misuse of grant funds. Examples ofcontrols agencies described for identifying and mitigating fraud risksincluded use of data checks to verify eligibility status and conductingregular reviews of grantee performance and financial data. Wewere unable to determine based on information communicated inthe remaining plan whether the agency addressed this directive indeveloping the plan. The agency did not identify any fraud risks orassociated mitigating controls in its plan. Further, M-18-14 does notspecify what key information agencies should communicate in theirplans in order to demonstrate the use of a risk-based approach todesigning and implementing controls to identify and mitigate fraudrisks.

Leverage existing ERM processes. M-18-14 states that in assessingrisk in disaster situations, agencies should leverage their existing ERMprocesses, including assessments that contribute to the developmentof initial risk profiles. In three of the five plans we reviewed, agenciesincluded information related to how the agencies leveraged existingERM processes to assess risk in disaster situations. For example,one agency's plan listed its relevant existing ERM risks and thepotential effect of those risks on disaster programs. The remainingtwo agencies did not include sufficient information in their plans forus to determine that they addressed the directive in developing theirplans. For example, one of the agencies included no reference to ordescription of ERM processes in its plan. Without such a descriptionincluded in the plan, we were unable to determine if that agency hadleveraged its ERM process to assess risk. Further, M-18-14 does notspecify what information agencies should communicate in their plansin order to demonstrate that they leveraged ERM processes.

Weigh operational objectives. M-18-14 states that whendetermining risk tolerances in disaster situations, managers mustweigh the program’s operational objectives against the objective oflowering the likelihood of fraud. In two of five plans we reviewed,

Page 12 GAO-19-479




agencies included information related to how, when determining risktolerances in disaster situations, they weighed operational objectivesagainst the objective of lowering the likelihood of fraud. For example,one agency's plan included a risk-appetite statement that describedaccepting higher fraud risk in order to provide more timely assistanceto aid recipients. The remaining three agencies did not includesufficient information in their plans for us to determine how theyaddressed this directive in developing their plans. For example, whileone agency included fraud-related risks and mitigation strategies inits plan, it did not include operational objectives or risk tolerances.Without such information included in the plan, we were unable todetermine if that agency had weighed operational objectives orrisk tolerances. However, M-18-14 does not specify that agenciescommunicate such information in their plans.

Provide reasonable assurance. M-18-14 states that agenciesreceiving disaster relief and emergency funding must providereasonable assurance that their internal control plans specificallyaddress disaster relief. In two of the five plans we reviewed, agenciesincluded information related to providing reasonable assurancethat their plans specifically addressed disaster relief. For example,two agencies’ plans identified the specific laws that provided theseagencies with supplemental appropriations for disaster relief anddescribed how the plans addressed requirements in those laws. Theremaining three agencies did not include sufficient information intheir plans for us to determine how they addressed this directivein developing their plans. For example, one of these three agenciesdescribed incremental risks and mitigation strategies in its plan, butdid not communicate how the controls specifically addressed disasterrelief. Without such a description, we were unable to determinehow that agency would provide assurance that its plan specificallyaddressed disaster relief. However, M-18-14 does not specify thatagencies include in their plans information demonstrating how theywill provide reasonable assurance the plans address disaster relief.

Complement existing risk management practices. M-18-14states that agencies’ internal control plans for disaster funds shouldcomplement risk-management practices as directed in OMB CircularA-123. In two of the five plans we reviewed, agencies includedinformation that demonstrated that the plans complemented thecircular's risk management practices. For example, one agency's planincluded a risk-appetite statement and identified program objectivesand risks to achieving those objectives, along with mitigating controls.The remaining three agencies did not include sufficient information

Page 13 GAO-19-479




in their plans for us to determine how the agencies addressedthis directive in developing their plans. For example, while one ofthe agencies described its plan as a risk management plan, theagency did not specify program objectives and risks to achieving theobjectives. Without such a description, we were unable to determinehow the agency's internal control plan complemented its existingrisk management practices. However, M-18-14 does not specifywhat information agencies should communicate in their plans inorder to demonstrate that the plans complement Circular A-123 riskmanagement practices.

Incorporate federal internal control standards. Federal internalcontrol standards provide the overall framework for establishing andmaintaining internal control in the federal government and consistof five components and 17 principles that are integral to an entity’sinternal control system. While three of the five agencies’ internalcontrol plans included information that related to most of the 17principles, none of the agencies provided sufficient descriptionsof how their internal control plans met all 17 principles of internalcontrol or rationales for why specific principles were not relevant. Forexample, none of the internal control plans clearly communicatedhow the agency’s oversight body and management demonstrateda commitment to integrity and ethical values. M-18-14 did notspecifically direct agencies to address the five components and17 principles of internal control. However, M-18-14 states thatagencies’ internal control plans should complement risk managementpractices as directed in Circular A-123, which prescribes requirementsconforming with federal internal control standards.

OMB did not have an effective strategy to ensure that its guidancefor disaster relief internal control plans would help agencies providesufficient information to Congress and others. OMB issued M-18-14in response to the statutory requirement to issue standard guidancefor federal agencies to use in designing internal control plans. M-18-14provided a general description of the process for developing theplans through Circular A-123 ERM requirements; however, thememorandum did not provide clear guidance to federal agencies onthe purpose of internal control plans or the type of information thatwas expected to be included in those written plans.

OMB also did not have an effective outreach strategy to helpensure that agencies had proper assistance in developing andreporting these internal control plans. OMB did not establish anexternal communication mechanism with an entity such as the Chief

Page 14 GAO-19-479




Financial Officers Council to determine how agencies could externallycommunicate key payment-integrity risks that they must address fordisaster funds.

OMB staff stated that the current guidance framework was sufficientfor the internal control reporting requirements; that Circular A-123ERM requirements were sufficient for agencies to produce effectiveinternal control plans, because agencies should consider disastersituations as part of their overall consideration of risk. OMB staff alsostated that agency managers must be able to prioritize risks, and byimplementing ERM, Circular A-123 gives agency managers neededflexibility to address those risks that are most significant. OMB staffstated that risks associated with disaster aid funding may not rise tothe same level as other risks that agencies face and thus additionalcontrols may not be warranted. In addition, OMB staff stated that inorder to provide flexibility to agencies, their guidance did not specifywhat key information should be conveyed in the internal controlplans.

While it is important that agencies develop effective ERM processes,ERM does not negate the need for assuring effective internalcontrols over disaster funds. As part of its oversight frameworkfor 2017 disaster funds, Congress specifically required agencies tocommunicate internal control plans associated with the supplementalfunding provided. Congress further specified for the plans toidentify and mitigate risks associated with the funding, and forthe plans to document the linkage between the incremental risksrelated to disaster funding and efforts to address known internalcontrol risks. This requirement served as a mechanism to providetransparency to Congress and others to assure that the agencies haveproperly evaluated their internal controls to help ensure the properaccountability over their funding. By including this requirement,Congress communicated its view that disaster funding carried specificrisks that needed to be addressed by federal agencies. However,with OMB’s focus on ERM, it is possible for agencies to determinethat disaster funding does not rise to the level of a significant risk;therefore, agencies’ internal control plans would not specificallyaddress risks associated with disaster funding.

Further, absent clear reporting guidance, such as criteria specifyingplan content or illustrative examples of completed plans, certainfederal agencies had difficulties in developing their plans. Officials atEducation, HUD, and SBA stated that they consulted OMB’s HurricaneSandy–related guidance in M-13-07, which included an internal control

Page 15 GAO-19-479




plan template, to help them develop their internal control plans. Also,officials at certain agencies said that it might be helpful to hear fromother agencies about the internal control risks they identified for 2017disaster funds and how they addressed those risks.

Federal internal control standards state that management shouldexternally communicate necessary quality information to achievethe entity’s objectives. 9 For example, information communicatedto oversight bodies includes significant matters relating to risks,such as with disaster relief spending, that Congress has required bemitigated and reported. This communication is necessary for theeffective oversight of internal control. Without a clear OMB strategyfor preparing for oversight of future disaster relief funding, there isan increased risk that agencies will not appropriately assess risksassociated with disaster funding. Further, Congress and others maynot be provided the necessary information about internal controls;this will affect their ability to provide effective oversight.

OMB Has NotImplementedOur PriorityRecommendationon Disaster FundingGuidance

We have previously reported deficiencies related to OMB’s guidancefor development of internal control plans related to disasterfunds. Specifically, in 2013, we reported on several weaknesses inOMB’s guidance that limited agencies' effectiveness in providinga comprehensive oversight mechanism for disaster funds. 10

Specifically, the guidance (1) focused on identifying incrementalrisks without demonstrating that known risks had been adequatelyaddressed; (2) provided agencies with significant flexibility as it didnot require documentation or criteria for claiming exceptions, suchas why the OMB requirements were not feasible or practicable; and(3) resulted in certain agencies developing their internal controlplans at the same time that funds needed to be quickly distributed.We recommended that OMB develop more robust guidance foragencies to design internal control plans for future disaster relieffunding. In commenting on the draft report, OMB staff generallyagreed with our recommendation. On July 15, 2016, OMB issued therevised Circular A-123. The circular requires agencies to implementERM, which includes developing a risk profile that analyzes risks toachieving strategic objectives and identifies options for addressingthe risks. However, the revised circular did not include specific

9 GAO-14-704G.10 GAO-14-58.

Page 16 GAO-19-479




guidance for identifying risks related to disaster funding; thus, therecommendation remains open. We plan to continue monitoringOMB’s progress in implementing this priority recommendation.

Page 17 GAO-19-479




Conclusions

The destruction that disasters cause must be addressed immediately,and agencies must deliver disaster relief funding expeditiously.However, the risk of improper payments increases when agenciesspend billions of dollars quickly. In mandating that agenciessubmit internal control plans for spending disaster relief fundingin accordance with OMB guidance, Congress underscores theimportance of establishing strong internal controls to help ensure thatthese funds are appropriately safeguarded. These plans serve as acritical transparency tool to provide Congress some assurance thatagencies will establish effective and efficient controls over the disasterfunds. Selected agencies did not communicate timely or sufficientinformation related to their internal control plans for disaster relieffunds. While OMB directed agencies to use a risk-based approach tointernal control in disaster situations, OMB did not have an effectivestrategy for ensuring that agencies communicated sufficient andtimely internal control plans. As a result, Congress and others may notbe able to fully assess the extent to which agencies achieve paymentintegrity objectives for the disaster relief funds.

Page 18 GAO-19-479




Agency Comments and Our Evaluation

We provided a draft of this report to OMB, DOD, DHS, Education,HUD, SBA, and USDA. OMB staff provided comments via email thatdisagreed with our recommendation, which we summarize below.Education provided comments, which are reproduced in appendixI. SBA provided comments via email, which are summarized below.DOD, DHS, HUD, and USDA informed us that they had no comments.

In its comments, OMB disagreed with our recommendation that itshould develop a strategy for ensuring that agencies communicatesufficient and timely internal control plans for effective oversight ofdisaster relief funds. OMB staff stated that OMB did not believe thesufficiency or timeliness of control plans present material issues thatwarranted OMB action. While OMB acknowledged that almost allagency control plans were submitted after the statutory deadline,OMB staff stated that this delay in itself neither indicated the absenceof controls nor the effectiveness of those controls. Further, OMBstaff stated that it is agency management and not OMB that hasresponsibility for ensuring compliance with applicable laws andregulations.

While agencies were responsible for submitting their internal controlplans, federal law placed the responsibility of establishing the criteriafor the internal control plans with OMB. We found that OMB providedneither timely nor sufficient guidance to agencies for developingtheir internal control plans. Specifically, OMB issued M-18-14 1 daybefore agencies were required to submit their internal control plans.Further, M-18-14 provided a general description of the process fordeveloping the plans through Circular A-123 ERM requirements, butit did not provide clear guidance on the purpose of internal controlplans or the type of information that was expected to be included inthe written plans. Because OMB did not establish an effective strategyfor timely communicating requirements for agency reporting ininternal control plans, federal agencies lacked the information neededto meet the statutory deadline. In addition, absent clear reportingguidance, such as criteria specifying plan content or illustrativeexamples of completed plans, certain federal agencies had difficultiesin developing their plans.

OMB staff also stated that OMB believed its guidance, in particularCircular A-123, which OMB said implements GAO’s Standards forInternal Control in the Federal Government and GAO’s A Frameworkfor Managing Fraud Risks in Federal Programs, provides the guidance

Page 19 GAO-19-479




needed to prepare agencies’ control plans. OMB staff stated thatcontrol plans in an effective system of internal control should beoperational, iterative, living documents that should be updated inresponse to emerging risks. 11 According to OMB staff, internal controlplans are not developed for external communications and are not thesources of assurances over disaster relief funds, which are publishedin agencies’ annual financial reports.

While it is important that agencies implement Circular A-123, whichdirects agencies to develop effective ERM processes, we believe thatERM does not negate the need for assuring effective internal controlsover disaster relief funds. As we noted in our report, with OMB’s focuson ERM, it is possible for agencies to determine that disaster fundingdoes not rise to the level of a significant risk; therefore, agencies’internal control plans would not specifically address risks associatedwith disaster funding. In addition, while it is important for agenciesto update their internal control plans in response to emerging risks,Congress specifically required agencies to communicate internalcontrol plans for the supplemental funds provided for activitiesrelated to the 2017 disasters. These plans, when provided timely andwith sufficient information, could serve as a critical transparency toolto provide lawmakers some assurance that agencies will establisheffective and efficient controls over the disaster funds. Therefore, webelieve that our recommendation is warranted.

In its written comments, Education acknowledged that developing andimplementing effective internal control plans is essential to assessingthe risks associated with federal disaster relief funding. Educationdisagreed with our assessment that its internal control plan did notprovide sufficient information for the following OMB directives inM-18-14:

• weigh operational objectives against the objective of lowering thelikelihood of fraud when determining risk tolerances in disastersituations,

• provide reasonable assurance that the internal control planspecifically addresses disaster relief, and

• describe how the plan complements existing risk managementpractices as directed in OMB Circular A-123.

11GAO, A Framework for Managing Fraud Risks in Federal Programs, GAO-15-593SP(Washington, D.C.: July 2015).

Page 20 GAO-19-479




We did not see sufficient evidence in Education's plan to demonstratethat it addressed the three directives noted above. We acknowledgethat in our meetings with them, Education officials discussed with ushow the steps described in their plan related to M-18-14 directives.However, in determining whether agencies' plans communicatedsufficient information, we considered for purposes of this report onlythat information that agencies included in the plans themselves.

As previously stated, Education was the only agency in our scope tosubmit its internal control plan before the March 31, 2018, statutorydeadline. Because OMB issued M-18-14 1 day before the plans weredue, Education had little time to review directives in M-18-14 and stillsubmit its plan by the due date. As previously mentioned, Educationofficials stated that in the absence of more timely guidance fromOMB, they relied on OMB's previous guidance in M-13-07 to helpdevelop their internal control plan. As discussed in our report, OMBhas not developed a strategy for ensuring that agencies, such asEducation, communicate sufficient and timely internal control plansfor effective oversight of disaster relief funds. Without such a strategyand guidance, Congress and others may not be able to fully assessthe extent to which agencies achieve payment integrity objectives fordisaster relief funds.

In addition, Education stated that its internal control plan addressed,in part, all five components as outlined in the federal internal controlstandards, and it believed that our assessment did not take intoaccount the extent to which these components are integrated intoits internal control plan. However, federal internal control standardsconsist of five components, as well as 17 principles, all of which areintegral to an entity's internal control system. Our evaluation ofinternal control plans found that none of the agencies—includingEducation—provided sufficient descriptions of how their internalcontrol plans met all 17 principles of internal control or rationalesfor why any particular principles were not relevant. For example,none of the internal control plans clearly communicated how theagencies addressed principle 1, which states the oversight body andmanagement should demonstrate a commitment to integrity andethical values.

Education also commented that at a meeting held May 8, 2019, wenoted that in some cases its plan was deemed insufficient becauseof either the level of detail or formatting concerns. We disagree withthis comment. Our evaluation of the internal control plans focusedon whether the plans included sufficient information to demonstrate

Page 21 GAO-19-479




that they satisfied the OMB directives and federal internal controlstandards, and not concerns about formatting.

The SBA liaison—Program Manager, Office of Congressional andLegislative Affairs—stated that SBA's Office of Disaster Assistancedid not have any comments regarding the content of our draftreport. In its email, SBA stated that it has in place a comprehensive,robust system of internal control for its ongoing disaster responseoperations. SBA stated that its established system of internal controlcovered the higher risks of improper payments and fraud thatcome with a larger volume of transactions following a series oflarge disasters. SBA further stated that its internal control systemhas proven effective during disasters of all sizes, and that a largervolume of transactions does not fundamentally change its internalcontrol system. In addition, SBA stated that writing a supplementarycomprehensive plan on risks and controls for an existing disasterresponse program would be both duplicative and of low value, andthat this would seem to contradict the effort to reduce the burden onfederal agencies in order for them to operate more effectively andefficiently to comply with the President’s Management Agenda.

As part of our audit, we did not evaluate the extent to which SBA’sinternal control system was effective in preventing improperpayments and fraud. Rather, we evaluated whether selected agencies—including SBA—met Congress's statutory mandate to timely submitinternal control plans with sufficient information to demonstrate thatagencies met OMB directives and federal internal control standardsrequirements. Despite SBA's concern that such plans for existingdisaster response programs would be duplicative and of low value,Congress, as part of its oversight framework for 2017 disaster funds,specifically required agencies to communicate internal controlplans for the supplemental disaster relief funding it provided. Thisrequirement served as an external communication mechanism toprovide transparency to Congress and others to assure that theagencies have properly evaluated their internal controls to helpensure accountability over their funding.

- - - - - - - - - - -

We are sending copies of this report to the appropriate congressionalcommittees; the Secretaries of Agriculture, Defense, Education,Homeland Security, and Housing and Urban Development; theAdministrator of the Small Business Administration; the Director ofthe Office of Management and Budget; and other interested parties.

Page 22 GAO-19-479




In addition, the report is available at no charge on the GAO website athttp://www.gao.gov.

If you or your staff have any questions about this report, pleasecontact me at (202) 512-2623 or [email protected]. Contact pointsfor our Offices of Congressional Relations and Public Affairs maybe found on the last page of this report. GAO staff who made keycontributions to this report are listed in appendix II.

Beryl H. Davis

Director

Financial Management and Assurance

Page 23 GAO-19-479

http://www.gao.gov





Congressional Addressees

Addressees

The Honorable Michael EnziChairmanCommittee on the BudgetUnited States Senate

The Honorable Ron JohnsonChairmanThe Honorable Gary C. PetersRanking MemberCommittee on Homeland Security and Governmental AffairsUnited States Senate

The Honorable Rand Paul, MDChairmanSubcommittee on Federal Spending, Oversight and EmergencyManagementCommittee on Homeland Security and Governmental AffairsUnited States Senate

The Honorable Marco RubioChairmanCommittee on Small Business and EntrepreneurshipUnited States Senate

The Honorable Maxine WatersChairwomanCommittee on Financial ServicesHouse of Representatives

The Honorable Sean DuffyRanking MemberSubcommittee on Housing, Community Development and InsuranceCommittee on Financial ServicesHouse of Representatives

The Honorable Al GreenChairmanSubcommittee on Oversight and InvestigationsCommittee on Financial ServicesHouse of Representatives

The Honorable Bennie Thompson

Page 24 GAO-19-479




ChairmanCommittee on Homeland SecurityHouse of Representatives

The Honorable Elijah CummingsChairmanThe Honorable Jim JordanRanking MemberCommittee on Oversight and ReformHouse of Representatives

The Honorable Nydia VelázquezChairwomanCommittee on Small BusinessHouse of Representatives

The Honorable Peter DeFazioChairmanThe Honorable Sam GravesRanking MemberCommittee on Transportation and InfrastructureHouse of Representatives

The Honorable Emanuel Cleaver, IIHouse of Representatives

The Honorable Michael McCaulHouse of Representatives

The Honorable Gary J. PalmerHouse of Representatives

The Honorable Ann WagnerHouse of Representatives

Page 25 GAO-19-479




Appendixes

Appendix I: Comments from the Department of Education

Page 26 GAO-19-479




Page 27 GAO-19-479




Appendix II: GAO Contact and Sta Acknowledgments

GAO Contact Beryl H. Davis, (202) 512-2623 or [email protected]

StaAcknowledgments

In addition to the contact named above, Matthew Valenta (AssistantDirector), Daniel Flavin (Auditor in Charge), Anthony Clark, JohnGrobarek, Diana Lee, and Angela Wills made key contributions to thisreport.

Page 28 GAO-19-479





Contacts

Report Director(s)Beryl H. DavisDirector, Financial Management and Assurance, (202) 512-2623,[email protected]

Congressional RelationsOrice Williams Brown, Managing Director, [email protected], (202) 512-4400

Public AairsChuck Young, Managing Director, [email protected], (202) 512-4800

Strategic Planning and External LiaisonJames-Christian Blockwood, Managing Director, [email protected], (202)512-4707

Obtaining Copies of GAO Reports and TestimonyThe fastest and easiest way to obtain copies of GAO documents at no costis through our website. Each weekday afternoon, GAO posts on its websitenewly released reports, testimony, and correspondence on our website. Youcan also subscribe to GAO’s e-mail updates to receive notification of newlyposted products.

Order by PhoneThe price of each GAO publication reflects GAO’s cost of production anddistribution. Pricing and ordering information is posted on our website.

To Report Fraud, Waste, and Abuse in Federal ProgramsWebsite: http://www.gao.gov/fraudnet/fraudnet.htmAutomated answering system: (800) 424-5454 or (202) 512-7470

Connect with GAOConnect with GAO on Facebook, Flickr, LinkedIn, Twitter, and YouTube.Subscribe to our RSS Feeds or E-mail updates. Listen to our Podcasts. VisitGAO on our website and read the Watchblog.

(102711) Page 29 GAO-19-479





https://www.gao.gov/

https://www.gao.gov/subscribe/index.php

http://www.gao.gov/ordering.htm

http://www.gao.gov/fraudnet/fraudnet.htm

https://www.facebook.com/usgao

https://www.flickr.com/photos/usgao

http://www.linkedin.com/company/us-government?trk=cp_followed_name_us-government

http://twitter.com/usgao

http://www.youtube.com/usgao

https://www.gao.gov/feeds.html

https://www.gao.gov/subscribe/index.php

https://www.gao.gov/podcast/watchdog.html

https://www.gao.gov/

https://blog.gao.gov/

GAO-19-479, 2017 Disaster Relief Oversight: …June 2019 2017 DISASTER RELIEF OVERSIGHT Strategy...

Documents

Transcript of GAO-19-479, 2017 Disaster Relief Oversight: …June 2019 2017 DISASTER RELIEF OVERSIGHT Strategy...